A series of attacks against small and medium-sized businesses has led to major cryptocurrency losses for the victims.
BlueNoroff, an advanced persistent threat (APT) group that's part of the larger Lazarus Group associated with North Korea, is behind a series of attacks against small and medium-sized companies that have led to serious cryptocurrency losses.
The campaign, dubbed SnatchCrypto, targets organizations that deal with cryptocurrencies and smart contracts, decentralized finance, blockchain, and the financial technology industry in their work, report the Kaspersky researchers who observed it. These companies were targeted for a reason, they said: Startups often receive messages and documents from unfamiliar senders.
"As most cryptocurrency businesses are small or medium-sized startups, they cannot invest lots of money into their internal security system," researchers wrote in a blog post. "The actor understands this and takes advantage by using elaborate social engineering schemes."
In this campaign, the attackers attempt to manipulate the victim by pretending to be an existing venture capital firm. Researchers saw the names of more than 15 venture businesses used in these attacks but believe the actual organizations have nothing to do with the threat.
Attackers send these startup employees a "full-featured Windows backdoor with surveillance functions, disguised as a contract or another business file," researchers report. If the file is opened on a device connected to the Internet, another macro-enabled document would be obtained to deploy malware.
This malware sends the target's general information and PowerShell agent to the attackers, creating a backdoor. From there, BlueNoroff deploys additional tools, including a keylogger and screenshot taker, to monitor victims. After weeks or months of tracking, the attackers find a prominent target and use the data they've collected to steal large amounts of cryptocurrency from them.
About the Author(s)
You May Also Like
Guarding the Cloud: Top 5 Cloud Security Hacks and How You Can Avoid Them
April 4, 2024Cybersecurity Strategies for Small and Med Sized Businesses
April 11, 2024Defending Against Today's Threat Landscape with MDR
April 18, 2024Securing Code in the Age of AI
April 24, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024Black Hat Asia - April 16-19 - Learn More
April 16, 2024